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Noise causes severe difficulties in implementing quantum computing and quantum cryptography. 
Several schemes have been suggested to reduce this problem, mainly focusing on quantum com- 
putation. Motivated by quantum cryptography, we suggest a coding which uses N quantum bits 
(N — n 2 ) to encode one quantum bit, and reduces the error exponentially with n. Our result sug- 
gests the possibility of distributing a secure key over very long distances, and maintaining quantum 
states for very long times. It also provides a new quantum privacy amplification against a strong 
adversary. 
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The ability to correct errors in a quantum bit (qubit) 
is crucial to the success of quantum computing, and it is 
very important to the success of quantum cryptography. 
Motivated by quantum computing, Shor |Q shows that 
quantum errors can be corrected (in some analogy to clas- 
sical error correction |^]). The many works which follow 
Shor's idea focus on improving his result |^-^] to better 
fit the requirements of quantum computing, or to pro- 
vide a better understanding of the properties of the error- 
correction codes (the previous works and also In 
this work we apply this idea to quantum cryptography, 
where reducing the error rate is the main aim. We em- 
phasize the properties of quantum error-correction which 
are relevant to quantum cryptography, and we show that 
quantum cryptography can be tremendously improved 
using a simple generalization of Shor's scheme. 

Quantum cryptography lOQias already taken some 
promising experimental steps |11|, and, to certain limits, 
it can work without involving the complications added 
by error-correction (or more precisely, error-reduction) 
schemes. In reality, there is noise due to preparing, trans- 
mitting and receiving the quantum states, and practi- 
cal protocols deal with small error-rates. However, the 
noise still causes a severe problem due to the combina- 
tion of the following two reasons: (1) The information 
available to an eavesdropper (Eve) on a single bit de- 
pends on the error-rate which the legitimate users (Alice 
and Bob) accept jl2|,[l3| , and reducing this error-rate re- 
duces Eve's information on the final key. Moreover, secu- 
rity analysis (e.g., |l3|]) is restricted to small error rates, 
and removing this restriction might make the analysis 
(technically) impossible. (2i) Existing error-rates do not 
allow key distribution over long distances, due to error 
accumulation over distance. This is the main problem 
of practical quantum key distribution, and currently fll| l 
the best existing systems distribute a key to distances 
of up to 30 km. The scheme we present here might en- 
able one to increase this distance significantly, suggest- 
ing that a lot of effort should be spent on this direction. 
(2ii) Some quantum cryptographic schemes |T^ , |l5|] use 
quantum memory instead of (or in addition to) quan- 
tum channels. Reducing the errors in such schemes is 
important since it allows keeping the states unchanged 
for a desirable time. (This was partly suggested in [M ; 
a discussion of related works is done in the concluding 
paragraph.) Moreover, the quantum cryptographic net- 
work |T^ 1 which allows communication between any two 
users (while using no quantum channels between them) 
already uses the same experimental ingredients as error- 
reduction schemes. Therefore, improving quantum cryp- 
tography in the future, using error-reduction schemes, 
might make such a scheme favorite. 

The error-reduction scheme we suggest here allows, in 
principle, to reduce the noise in a transmission channel or 
in a quantum memory to any desirable level. This result 
is important (from a theoretical point of view) for im- 



plementing a "quantum privacy amplification" scheme, 
as an alternative to another quantum privacy amplifica- 
tion scheme E^] which is based on purification of singlet- 
pairs ]T^ | . Such schemes provide a promising direction for 
proving the ultimate security of quantum cryptography, 
as an alternative to the more practical approach of |l3| . 

Classical error-correction is based on redundant encod- 
ing which uses more than one bit (on average) to encode 
one bit. The simplest scheme is the 1 — ► 3 repetition code 
in which each bit is repeated three times in the encoding, 
and a majority vote is chosen for decoding. In this case, 
if a single bit contains an error with probability p (where 
p is small), and pi = (J)p l (l — p) 3 ~ l is the probability 
of having exactly I errors, then the probability to have a 
remainder error (the probability of having two or three 
errors in three bits) is P = p2 + P3 — 3(1 — p)p 2 + p 3 = 
3p 2 — 2p 3 . One must keep in mind that this result is 
true on average, but in case we know that one error was 
identified and corrected [which happens with probability 
P2+P1 = 3p 2 (l — p) + 3p(l —p) 2 ] the probability of hav- 
ing a remainder error is exactly P2/{pi + P2) = P, and we 
gain no error reduction at all! 

The analogous quantum error-correction [0 uses 9 
qubits to encode a single qubit (to perfectly correct a 
single error) using the following procedure: a 1 — > 3 rep- 
etition code in the z basis |0) — > |000) and |1) — > |1H) 
(where |000) stands for the tensor product |0)|0)|0) of 
three qubits); a transformation to the x basis |0) — > 
(l/\/2)(|0) + |1)) and |1) -> (l/%/2)(|0) - |1» for each 
qubit; and finally, again a 1 — > 3 repetition code in the 
(new) z basis. All together, the encoding is: 



|0> -> -^(|000> + |111»(|000) + |111))(|000) + |111» 
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(|000) - |111»(|000) - ]111»(]Q00> - |111» . (1) 



We denote it as R3UR3 where R n stands for 1 — > n 
repetition code, and U for rotation from the z basis to 
the x basis. 

For cryptographic purposes, one is interested in error- 
reduction schemes, which leave a minimal remainder er- 
ror, rather than in error-correction schemes, which leave 
a higher remainder error. For that aim, the majority vote 
decoding should be replaced by an unanimous decision; 
in case of a disagreement the bit is thrown away. The 
classical (1 — > n) repetition code R n with n = 2t + 1 
provides successful unanimous decision with probability 
Q = (1 — p) n +p n , and the remainder error in this case is 

P = p n /Q which is P w ^ or sm all p. This code 

can also be used to correct up to t errors, but with a much 
higher (average) remainder error, which can be calculated 
from the binomial expansion of [p+ (1 — £>)]". However, if 
exactly t errors were identified and corrected, the prob- 
ability that there were actually t + 1 errors (hence, a 
remainder error) is p. 
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For n — 3 the remainder error in the error-reduction 
scheme is P f=a p 3 + 3p 4 which is much improved in com- 
parison to the (average) remainder error in case of error- 
correction, and even the n = 2 error-reduction code pro- 
vides a remainder error Psip 2 | 3p 3 which is better than 
3p 2 — p 3 for small p. This was first noted by Vaidman, 
Goldenberg and Wiesner (VGW) Jl6| who presented the 
quantum error-reduction scheme R2UR2 to improve the 
remainder error while using only 4 qubits instead of 9 
for the encoding. The error-reduction process is done 
by projecting the state of the code qubits on a desir- 
able subspace; for instance, in case of the n = 3 quan- 
tum error-reduction code, it is projected on the subspace 
spanned by the two states of eq. |l|. If the projection fails, 
the qubit is not corrected but is thrown away. Throwing 
the bits has only small influence on a quantum key dis- 
tribution protocol since the legitimate users throw away 
most of the bits due to other reasons. Note that this is 
not appropriate for quantum computing, where throwing 
one bit in the computing process destroys the computa- 
tion. On the other hand, for cryptographic purposes, the 
number of bits used for the decoding is less important (in 
comparison to the requirements of quantum computing) , 
since neither of the existing protocols makes use of the 
coherence of more than two particles. 

Error-correction can be easily combined into an error- 
reduction scheme for the price of increasing the remain- 
der error P. The benefit of such a combination is that the 
probability of successful projection, Q, is increased. For 
simplicity we shall consider only "pure" error-reduction 
scheme, but our scheme can be generalized to combine 
the correction of few bits as well. In a scheme which com- 
bines error-reduction and (i'-errors) error-correction, one 
has to check into which subspace the state is projected, 
and if this subspace corresponds to t' errors (or less) the 
state is corrected by simple transformations (see [Q etc.). 

We conclude that the codes which are used for quan- 
tum error-correction must be modified to provide error 
reduction in order to fit the requirements of quantum 
cryptography much better. For example, we suggest to 
use error-reduction codes R n UR n with large n. Such 
codes encode one qubit into N — n 2 qubits, in order to 
reduce the error-rates exponentially with n (more effi- 
cient codes could be used as well, based, for instance, 
on |,[|§). The rest of this paper is devoted to the anal- 
ysis of these codes. As in all discussions on quantum 
error-correction, coherent transformations of many par- 
ticles are dismissed since, in real channels, such errors are 
much smaller than errors in individual bits. However, we 
consider also eavesdropping aspects, and therefore, this 
issue is more subtle and we elaborate it further later on. 

It is generally believed that it is enough to correct 
phase errors, bit errors and bit-phase errors in order to 
protect against any independent error (see the analysis 
in j^^] ) . The intuitive problem with such argument is the 
assumption that each qubit is either strongly disturbed 



(due to bit flip in some basis) or not disturbed at all, 
while in reality, all qubits are slightly changed. Follow- 
ing Jl],||,[|[l6]||-0] and other works on this subject we find 
the remainder error P and the probability of success Q 
given that bit errors, phase errors and phase-bit errors 
occur with probability p. However, for the simple special 
case of the code R2UR2 we demonstrate the error reduc- 
tion explicitly by discussing a general transformation on 
each bit. 

A qubit is described by a two-dimensional Hilbert 
space (say, spin of a spin-half particle) a\0) + /3|1) with 

M 2 + l£ 

state I* 

space, with |0 H ) = |0i0 2 • ■•()„) and |1 R ) = | li 1 2 ■ • • In)- 
When it is encodes using R n UR n we get the state 
\* RUR ) = «I<W + P\l RUR ) of N = n 2 qubits in a 2^ 
dimensional Hilbert space, with 



2 = 1. When it is encoded using R n we get the 
) = a\0 R ) + (3\1 R ) in a 2 n dimensional Hilbert 
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(|0i---0„) - |li •••!„)) 



(|0l • ■ • 0„) - |li • ■ ■ 1„)) . . . (|0i • ■ • On) - |ll • ■ • l n » (2) 

where there are n multiplets of n bits each. In the decod- 
ing process, the disturbed state is projected on the desir- 
able 2-dimensional subspace spanned by the two states 
\0 Rt/R ) and \l RUR ). Let us see the influence of the dif- 
ferent types of errors on the final state. (1) Bit errors: 
Opening the parentheses, it is easily seen that bit-errors 
in less then n bits cannot bring the state back into the 
desirable subspace. (2) Phase errors: It is not easy to 
calculate the number of phase errors which can bring 
the state back to the relevant subspace, if we use the 
z basis; however, phase errors in the z basis are bit er- 
rors in the x basis (see jl],[|, etc.). Therefore by trans- 
forming this state to the x basis of each qubit, the two 
states \0 RUR ) and \ ^ RUR ) become superposed from differ- 
ent words which differ by at least n bits, and thus, n 
phase errors are required in order to bring the original 
state back to the relevant subspace. (3) Phase-bit errors: 
Showing that only n such errors bring the state back to 
the desirable subspace is done using the same approach, 
by a transformation to the y basis. We conclude that 
the probability of success and the remainder error are in- 
deed Q w (1 — p) n and P w p n /Q, as calculated for the 
classical error reduction scheme R n . 

We now provide a partial analysis of more realistic type 
of errors. Let each qubit in the code be transformed ar- 
bitrarily (but independently). In general, the transfor- 
mation is not unitary since an ancila (e.g., environment) 
might be involved. However, we can still deal only with 
unitary transformations and the effect of decoherence 
(non-unitary transformations) is obtained by averaging 
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over several different unitary transformations with ap- 
propriate probabilities. A similar argument is provided 
in Restricting ourselves to "pure" error-reduction 
schemes, we must demand that all the individual unitary 
transformations be weak (close to unity) . In a generaliza- 
tion of our scheme which correct t' errors, up to t" (which 
is somewhat smaller than t') of the transformations are 
permitted not to be weak. 

We provide a complete analysis only for the code 
R2UR2, but such analysis can be extended to codes 
R n UR n with n > 2. Let each qubit j in the code be 
exposed to the most general one-particle transformation 
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(up to an irrelevant overall phase), where all angles are 
smaller than some small angle Xi so that p s» \ 2 . We 
write how the original state \^ RUR ) in the 2*- 2 > — 16 di- 
mensional Hilbert space is transformed (due to the ma- 
trix elements (0000|t/it/ 2 t/ 3 ?74|0011) etc.): 



( a + /3\ 



a- (3 


a- /3 



\a + J 



( ^0000 \ 
2^0001 

a^ooio 
a^oon 
a^oioi 

a^iioo 

351X01 
351110 
V 35X111 / 



(4) 
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with xoooo = i a + (3) cos 0i cos 2 cos 3 cos 64 + (a 
(3) cos 0i cos 6 2 sin 3 sin 4 e^ 3 e^ 4 + (a 
(3) sin 0i sin 2 cos 3 cos 4 e* e i<h 
{a + (3) sin 0i sin 2 sin 3 sin 4 e^ e i<h e 1 * 3 e^ 4 etc. 
jeeting the state onto the subspace spanned by \0 RUR ) — 
(1/2)(|0000) + 10011) + |1100) + |1111>) and \1 RUR ) = 
(1/2)(|0000) - |0011) - 1 1100) + |11H)), and defining 
C = (cos 0i •■■ cos 04 cos 0i ••• cos 04 cos 771 ••• cos 774) , 
we obtain, after a lengthy calculation, the (unnormal- 



ized) final state \& RUR ) 



C 



V0J 



0( X 2 



The final 



state, when normalized, is almost identical to the initial 
state \^ RUR ), where the terms which contribute to the 
correction are sin0isin02; sin ?y 3 sin 774 , etc., all of order 
0(x 2 ) or smaller. Thus, the remainder error probability 
is indeed 0(x 4 ) ~ 0(p 2 ), with probability of success C 2 . 

This code can be used for i'-bit error-correction scheme 
if we do not reject the encoded bit when the projection 
fails. Instead, we check into which subspace the state is 
projected. In this case the assumption that all angles are 
small can be dismissed, so that t" (which is smaller than 
t') angles can be large. Recall however that in these cases 
the remainder error-rate is not 0{x 2n ) anymore. 

The main problem of a scheme which performs only 
error reduction is that the probability of successful pro- 



jection diminishes when n is increased as (1 — p) n . We 
could combine it with some (small-t') error-correction as 
previously explained, but there is also a different solution, 
which should be preferable in case the noise changes in 
time as ~ wt etc. In this case the probability of suc- 
cess can be much improved using the Zeno effect (see 
discussion in [ |l6| , |l9| |) by performing M projections in be- 
tween, at equal time steps, reducing p to p/(M 2 ), and 
Q to (1 — -^) nM w 1 — np/M. The remainder error 
is also much improved by this process. Performing M 
projections is rather simple when enhancing a quantum 
memory is considered (meaning that it does not add any 
further complication). When transmission to long dis- 
tances is considered, Alice and Bob need to have "pro- 
jection stations" between them. This greatly improves Q 
and does not affect the security of the transmission. In- 
deed, since each such station is only required to perform 
the desired projection, it can even be controlled by the 
eavesdropper; if Eve tries to do anything other than the 
required projections — she increases the error-rate and 
will be detected. 

The only assumption required for the success of any 
error-correction or error-reduction scheme is that each 
code bit is disturbed independently of the others. If real 
noise causes many-particle transformations the scheme 
will fail, but for bits stored or transmitted separately, 
such effects are expected to be negligible. Thus, the le- 
gitimate users of quantum cryptography can use error- 
reduction schemes to decrease much of the noise, and, as 
a result, expect much less errors when comparing a por- 
tion of the data. It is important to note that the added 
assumption does not restrict the adversary, Eve. She 
is still allowed to do whatever she likes, including creat- 
ing many-particle coherence. The eavesdropping analysis 
needs only to take the final error-rate into account. We 
could even let Eve do all the transformations from the 
initial bit, through the encoding till she obtains the final 
bit. If she deviates from the protocols and the error-rate 
is larger than expected Alice and Bob quit the transmis- 
sion. If she deviates from the protocol but provides the 
final state with the allowed error-rate, Alice and Bob do 
not care which operations she has done, since the allowed 
small error-rate (which is verified), promises them that 
her information is limited as desired. This provides a new 
type of a privacy amplification scheme, simpler than the 
one recently suggested |Q| which is based on purifica- 
tion of singlets |[8| . Such schemes provide a proof of the 
ultimate security of quantum cryptography under the as- 
sumption that the legitimate users have perfect devices. 
Moreover, in case Eve gets the code bits without knowing 
which code bits encode a particular qubit, her informa- 
tion is reduced even more. This argument is similar to 
the randomization argument used in flT3| , p"7| . It may pro- 
vide the proof of perfect security even when Alice and 
Bob have real devices, since Eve cannot know which co- 
herence would be useful to her in advance, hence, her 
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information is reduced whether the legitimate users can 
observe this reduction or not! However, analyzing this 
aspect of quantum privacy amplification is rather com- 
plicated and it is beyond the scopes of this work. 

In conclusion, we have shown that quantum cryptog- 
raphy can be much improved by using quantum error- 
reduction schemes. Our result might be crucial for imple- 
menting quantum cryptography over large scale distances 
and times. It also provides an alternative quantum pri- 
vacy amplification scheme. We suggested a specific en- 
coding which yields exponentially small remainder error, 
and we suggested to implement it in a "many-stations" 
system, so that the probability of success will not become 
too small. The errors due to the frequent projections in 
a "many-stations" system were not considered here. As 
in the case of a fault-tolerant calculations || , it may well 
be that there is some optimal number of stations M such 
that a larger number of stations causes an increase of 
the remainder error. Note also that some errors are due 
to creation and measurement of the state in the labs of 
Alice and Bob, and for the time being these limits our 
ability to reduce P. However, the main limitations on 
quantum cryptography are maintaining coherence over 
long distances and times and these limitations are solved 
efficiently using the scheme we suggest. 

^From all works which recently appeared, the work of 
VGW [|l6| is more related to ours than the others. It con- 
siders the use of the quantum Zeno effect and the R2UR2 
error-reduction scheme to maintain quantum states in a 
quantum memory for a longer time. However, this work 
does not deal with the benefits of using a large number 
of code bits, and with improving transmission to large 
distances. Other less related works are these of [|]]|] 
which discusses quantum communication, and these of 
Steane HQ which discusses large n. 

The author is grateful to Gilles Brassard and Asher 
Peres for motivating this work, and to Eli Biham, Netta 
Cohen, Lior Goldenberg and Lev Vaidman for very help- 
ful discussions. 
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